8

Given the following code:

$myString = <<<script
   .
   .
   .
 script;

Thanks to the answers on the original version of this question, I understand <<< to be heredoc syntax, treated as double quotes without the need for escaping quotes.

Taking this a step further, how is this best exploited? Specifically, should this ease the strain of dealing with mixed quote strings containing code syntax?

i,e..

attribute="name-like string" attribute="property: 'value("value")';"

The thought is this may be useful (if implemented the way I am now guessing) especially when dealing with greater complexity and/or looking out for code injection. Again, looking for any scenarios where the heredoc for is particularly useful or exploitable.

Garet Claborn
  • 1,395
  • 2
  • 17
  • 42

3 Answers3

9

It's Heredoc syntax: http://php.net/manual/en/language.types.string.php#language.types.string.syntax.heredoc

Its biggest virtue is that you don't have to worry about escaping quotes, since the string is not quote delimited.

deceze
  • 471,072
  • 76
  • 664
  • 811
2

It's called heredoc syntax:

A third way to delimit strings is the heredoc syntax: <<<. After this operator, an identifier is provided, then a newline. The string itself follows, and then the same identifier again to close the quotation.

Read more here.

Demian Brecht
  • 20,087
  • 3
  • 37
  • 44
2

It acts as a double qouted string, better to use double qoutes, easier to understand and easier to mantain in my eyes!

Version1
  • 641
  • 5
  • 12
  • Niice.. It looked like a bitwise shift to me but figured it wasn't due to the extra " – locrizak Apr 19 '11 at 02:28
  • Indeed, but I find it easier to keep to one rule where I can, it makes it alot easier to write clean code, even though in some cases it can be useful, but it comes few and far between :) – Version1 Apr 19 '11 at 02:31
  • I hear ya, consistency is the best. – locrizak Apr 19 '11 at 02:35
  • 2
    heartily agree. thankfully this isn't *my* code =) I admit though, not escaping quotes in web code..seems like it could be pretty useful with strings of javascript and the like. Looking at this code, I don't think it was a bad practice as a search for << – Garet Claborn Apr 19 '11 at 03:54
  • The Heredoc differs from double quoted strings in that you don't need to escape double quotes. And which variant is “better to use” is highly debatable. – feeela Jul 18 '16 at 12:22